A Linux kernel vulnerability (CVE-2021-33624) has been identified, allowing the use of the eBPF subsystem to bypass protections against Spectre-class vulnerabilities, which can determine the contents of memory by creating conditions for speculative execution of certain operations. An attack leveraging Spectre requires a specific sequence of commands in privileged code that leads to the speculative execution of instructions. By manipulating the BPF programs passed for execution, it is possible to generate similar instructions in eBPF, leading to kernel memory content leakage and arbitrary physical memory areas through side channels.
The vulnerability is caused by shortcomings in the verifier used to detect errors and unauthorized activity in BPF programs. The verifier examines possible execution paths of the code but misses branching options that are semantically invalid according to the instruction set architecture. However, during the execution of a BPF program, such branching options not accounted for by the verifier can be mispredicted by the processor and executed speculatively. For example, when analyzing the 'load' operation, the verifier assumes that a register used in the instruction has an address whose value always lies within specified limits, but an attacker can create conditions under which the processor attempts to speculatively execute an operation with an address that does not meet the verification criteria.
The problem manifests starting from kernel release 4.15 and has been addressed in the form of patches (1, 2, 3, 4). In the distributions, the vulnerability remains unaddressed (Debian, RHEL, Ubuntu, Fedora, SUSE, Arch).
Additionally, a note can be made about the impact on the performance of tools designed to mitigate Spectre-class vulnerabilities. The note summarizes the results of the optimization of the rr (Record and Replay) debugger, which was created at Mozilla to debug hard-to-reproduce errors in Firefox. Caching system calls used to check the existence of directories has reduced the execution time of the 'rr sources' operation for a test project from 3 minutes 19 seconds to 36 seconds.
Az optimalizálásért felelős szakember ellenőrizni akarta, hogy mennyit változik a teljesítmény a Spectre-védelem kikapcsolása után. A rendszer „mitigations=off” paraméterrel való indítása után a „rr sources” futási ideje optimalizálás nélkül 2 perc 5 másodperc (1,6-szor gyorsabb) volt, optimalizálással pedig 33 másodperc (9%-kal gyorsabb). Érdekes módon a Spectre-védelem kikapcsolása nemcsak 1,4-szer csökkentette a kód végrehajtási idejét a kernel szinten (2m9s-ről 1m32s-ra), hanem kétszer csökkentette a felhasználói térben végrehajtott időt is (1m9s-ről 0m33s-ra), valószínűleg a CPU-cache hatékonyságának csökkenése és a TLB-visszaállások miatt a Spectre-védelem bekapcsolt állapotában.
Forrás: opennet.ru
